simpl.
Anmelden
Cybersicherheits-GRC 16 Punkte

Secure Software Development Lifecycle (SSDLC) Review

Diese Checkliste ist auf Englisch.

Reviews security integration across the software development lifecycle, from requirements and design through testing and deployment.

NIST SSDF 800-218OWASP ASVSISO 27001:2022

Kostenlos als PDF oder Word · E-Mail-Adresse eingeben und herunterladen.

Governance & Requirements

  • Are security requirements defined and documented for new features? *
  • Are developers trained in secure coding practices? *
  • Is a secure coding standard adopted (e.g., OWASP)? *

Design

  • Is threat modeling performed for new or significantly changed systems? *
  • Are security design reviews conducted before implementation? *
  • Are secure defaults and least-privilege principles applied in the architecture? *

Implementation & Testing

  • Is static application security testing (SAST) integrated into the pipeline? *
  • Is software composition analysis (SCA) used to detect vulnerable dependencies? *
  • Is dynamic testing (DAST) or penetration testing performed before release? *
  • Is peer code review required before merging to the main branch? *

Secrets & Dependencies

  • Are secrets scanned for and blocked from source code repositories? *
  • Are software dependencies pinned and sourced from trusted registries? *
  • Is a software bill of materials (SBOM) generated for releases? *

Deployment & Maintenance

  • Is code integrity protected through signing or verified build provenance? *
  • Are production deployments gated by security checks in CI/CD? *
  • Is there a process to receive and remediate reported vulnerabilities post-release? *

Vollständige Checkliste Secure Software Development Lifecycle (SSDLC) Review herunterladen

Kostenlos als übersichtliches, druckfertiges PDF oder als bearbeitbares Word-Dokument.